Sign-up

ID

VAR-202001-0772


CVE

CVE-2019-15712


TITLE

FortiMail admin  Vulnerabilities related to lack of authentication

Trust: 0.8

sources: JVNDB: JVNDB-2019-014335

DESCRIPTION

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. FortiMail admin Vulnerable to a lack of authentication.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Fortinet FortiMail is a suite of e-mail security gateway products from Fortinet. The product provides features such as email security and data protection. Fortinet FortiMail version 6.2.0, versions 6.0.0 to 6.0.6, and versions 5.4.10 and earlier have security vulnerabilities

Trust: 1.71

sources: NVD: CVE-2019-15712 // JVNDB: JVNDB-2019-014335 // VULHUB: VHN-147786

AFFECTED PRODUCTS

vendor:fortinetmodel:fortimailscope:lteversion:6.0.6

Trust: 1.0

vendor:fortinetmodel:fortimailscope:lteversion:5.4.10

Trust: 1.0

vendor:fortinetmodel:fortimailscope:gteversion:6.0.0

Trust: 1.0

vendor:fortinetmodel:fortimailscope:eqversion:6.2.0

Trust: 1.0

vendor:フォーティネットmodel:fortimailscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortimailscope:eqversion:6.2.0

Trust: 0.8

vendor:フォーティネットmodel:fortimailscope:eqversion:6.0.0 to 6.0.6

Trust: 0.8

vendor:フォーティネットmodel:fortimailscope:lteversion:5.4.10

Trust: 0.8

sources: JVNDB: JVNDB-2019-014335 // NVD: CVE-2019-15712

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-15712
value: HIGH

Trust: 1.0

NVD: CVE-2019-15712
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201910-1253
value: MEDIUM

Trust: 0.6

VULHUB: VHN-147786
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-15712
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-147786
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-15712
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-15712
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-147786 // JVNDB: JVNDB-2019-014335 // CNNVD: CNNVD-201910-1253 // NVD: CVE-2019-15712

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of authentication (CWE-862) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2019-014335 // NVD: CVE-2019-15712

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201910-1253

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201910-1253

PATCH

title:FG-IR-19-237url:https://fortiguard.com/psirt/FG-IR-19-237

Trust: 0.8

title:Fortinet FortiMail Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=111157

Trust: 0.6

sources: JVNDB: JVNDB-2019-014335 // CNNVD: CNNVD-201910-1253

EXTERNAL IDS

db:NVDid:CVE-2019-15712

Trust: 2.5

db:JVNDBid:JVNDB-2019-014335

Trust: 0.8

db:CNNVDid:CNNVD-201910-1253

Trust: 0.7

db:AUSCERTid:ESB-2019.3914.2

Trust: 0.6

db:AUSCERTid:ESB-2019.3914

Trust: 0.6

db:VULHUBid:VHN-147786

Trust: 0.1

sources: VULHUB: VHN-147786 // JVNDB: JVNDB-2019-014335 // CNNVD: CNNVD-201910-1253 // NVD: CVE-2019-15712

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-19-237

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2019-15712

Trust: 1.4

url:https://fortiguard.com/psirt/fg-ir-19-237

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2019.3914/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2019.3914.2/

Trust: 0.6

sources: VULHUB: VHN-147786 // JVNDB: JVNDB-2019-014335 // CNNVD: CNNVD-201910-1253 // NVD: CVE-2019-15712

SOURCES

db:VULHUBid:VHN-147786
db:JVNDBid:JVNDB-2019-014335
db:CNNVDid:CNNVD-201910-1253
db:NVDid:CVE-2019-15712

LAST UPDATE DATE

2024-08-14T14:26:00.179000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-147786date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2019-014335date:2020-02-10T00:00:00
db:CNNVDid:CNNVD-201910-1253date:2020-09-02T00:00:00
db:NVDid:CVE-2019-15712date:2020-08-24T17:37:01.140

SOURCES RELEASE DATE

db:VULHUBid:VHN-147786date:2020-01-23T00:00:00
db:JVNDBid:JVNDB-2019-014335date:2020-02-10T00:00:00
db:CNNVDid:CNNVD-201910-1253date:2019-10-21T00:00:00
db:NVDid:CVE-2019-15712date:2020-01-23T18:15:13.273